Speed Up Log Troubleshooting with a Powerful awk, tail, grep, and sed Toolkit

Yesterday a sporadic error alert appeared in production just before the end of the workday. A colleague tried to inspect the 2 GB application.log with cat, which flooded the terminal and forced a disconnection. The article demonstrates how backend engineers can master Linux log‑analysis commands— tail, less, grep, sed, and awk —to pinpoint problems efficiently.

tail

For large files, cat is impractical; tail provides real‑time monitoring.

Scenario A: Service start monitoring

# -f (follow) shows new lines as they are appended
tail -f logs/application.log

Scenario B: Test‑driven bug reproduction

When a tester clicks a button, only the latest output matters. The command shows the last 200 lines and follows new output:

tail -n 200 -f logs/application.log

less

less

loads files on demand, allowing smooth navigation of multi‑gigabyte logs.

Scenario: Tracing a customer‑complaint order

Search for order ORD12345678 from the end of the file: less logs/application.log Operation flow inside less:

Press Shift+G to jump to the end.

Enter ?ORD12345678 to search upward.

Press n to find the previous occurrence.

Press Shift+F for a tail -f -like live view; Ctrl+C returns to normal browsing.

grep

grep

is the most common search tool, but simple keyword matching often falls short.

Scenario A: Reconstructing the error context

Show the matching line plus 20 surrounding lines:

grep -C 20 "NullPointerException" logs/application.log

Scenario B: Full‑link trace by TraceId grep "TraceId-20251219001" logs/app.log* Scenario C: Counting exception frequency

grep -c "RedisConnectionException" logs/application.log

Scenario D: Excluding noisy INFO logs

grep -v "HealthCheck" logs/application.log

sed

When logs are huge (e.g., 10 GB) and the incident time window is known, sed can extract that slice.

Scenario: Exporting logs from 14:00 to 14:05

# Extract lines between the start and end timestamps
sed -n '/2025-12-19 14:00/,/2025-12-19 14:05/p' logs/application.log > error_segment.log

The resulting error_segment.log is only a few megabytes, easy to download or share.

awk

awk

excels at column‑oriented processing, useful for structured logs such as Nginx access logs.

Scenario A: Finding malicious IPs during a possible CC attack

awk '{print $1}' access.log | sort | uniq -c | sort -nr | head -n 10

Scenario B: Identifying requests with response time > 1 s awk '$NF > 1.000 {print $7, $NF}' access.log These one‑liners can be copied directly into the terminal.

Conclusion

The examples presented are common in daily production work. Memorizing or bookmarking these commands lets you handle incidents quickly by copying the appropriate snippet for the given scenario.